CVE-2026-12569 - PTC Windchill and FlexPLM Improper Input Validation / Unsafe Deserialization

union DeviceNetworkEvents, DeviceProcessEvents, CommonSecurityLog
| where TimeGenerated > ago(7d)
| where (
    (DeviceName has_any ("windchill", "flexplm") or Computer has_any ("windchill", "flexplm"))
    or (RequestURL has_any ("/Windchill/", "/FlexPLM/", "/ptc/", "/servlet/", "/wt.httpgw"))
    or (DestinationPort in (80, 443, 8080, 8443) and (RequestURL contains "java.io.ObjectInputStream" or RequestURL contains "rO0AB" or RequestURL contains "aced0005"))
)
| where (
    InitiatingProcessCommandLine has_any ("cmd.exe", "powershell", "bash", "sh", "wget", "curl", "certutil")
    or RequestURL has_any ("java.lang.Runtime", "ProcessBuilder", "rO0AB", "aced")
    or Activity has "Exploit"
    or AdditionalExtensions has_any ("CVE-2026-12569", "deserialization", "ObjectInputStream")
)
| project TimeGenerated, Computer, DeviceName, InitiatingProcessCommandLine, RequestURL, SourceIP, DestinationIP, DestinationPort, Activity, AdditionalExtensions
| order by TimeGenerated desc

index=web OR index=proxy OR index=endpoint sourcetype IN ("iis", "apache_access", "nginx_access", "wineventlog", "syslog")
| eval is_windchill_host=if(match(host, "(?i)(windchill|flexplm|ptc)"), 1, 0)
| eval is_windchill_uri=if(match(uri_path, "(?i)(/Windchill/|/FlexPLM/|/ptc/|/servlet/|/wt\.httpgw)"), 1, 0)
| eval deser_indicator=if(match(uri_query, "(?i)(rO0AB|aced0005|java\.io\.|ObjectInputStream|ProcessBuilder)") OR match(request_body, "(?i)(rO0AB|aced0005|java\.io\.)"), 1, 0)
| eval suspicious_spawn=if(match(process_name, "(?i)(cmd\.exe|powershell|bash|sh|wget|curl|certutil)") AND match(parent_process_name, "(?i)(java|tomcat|jboss|windchill)"), 1, 0)
| where is_windchill_host=1 OR is_windchill_uri=1 OR deser_indicator=1 OR suspicious_spawn=1
| eval risk_score=if(deser_indicator=1, 90, 0) + if(suspicious_spawn=1, 80, 0) + if(is_windchill_uri=1 AND status>=500, 30, 0)
| where risk_score > 0
| table _time, host, src_ip, uri_path, uri_query, status, process_name, parent_process_name, risk_score, deser_indicator, suspicious_spawn
| sort -risk_score, -_time

sequence by host.name with maxspan=5m
  [network where
    (url.path like~ "*/Windchill/*" or url.path like~ "*/FlexPLM/*" or url.path like~ "*/wt.httpgw*")
    and (
      url.query like~ "*rO0AB*" or
      url.query like~ "*aced0005*" or
      url.query like~ "*ObjectInputStream*" or
      http.response.status_code >= 500
    )
  ]
  [process where
    process.parent.name like~ "java*" or process.parent.name like~ "tomcat*"
    and process.name in ("cmd.exe", "powershell.exe", "bash", "sh", "wget", "curl", "certutil.exe")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  magnitude
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) IN ('Microsoft IIS', 'Apache HTTP Server', 'Nginx', 'Linux OS')
  AND (
    URL ILIKE '%/Windchill/%'
    OR URL ILIKE '%/FlexPLM/%'
    OR URL ILIKE '%/wt.httpgw%'
    OR URL ILIKE '%rO0AB%'
    OR URL ILIKE '%aced0005%'
    OR URL ILIKE '%ObjectInputStream%'
    OR "Process Name" ILIKE '%cmd.exe%'
    OR "Process Name" ILIKE '%powershell%'
    OR "Process Name" ILIKE '%wget%'
    OR "Process Name" ILIKE '%curl%'
  )
  AND LAST 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=web* OR _sourceCategory=endpoint* OR _sourceCategory=proxy*
| where _raw matches "(?i)(Windchill|FlexPLM|wt\.httpgw)"
   OR _raw matches "(?i)(rO0AB|aced0005|ObjectInputStream|java\.io\.)"
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "\"(?:GET|POST|PUT|PATCH|DELETE|HEAD) (?P<uri_path>[^\s]+)" nodrop
| parse regex "HTTP\/[0-9.]+ (?P<status_code>\d{3})" nodrop
| parse regex "process=(?P<process_name>[^\s,]+)" nodrop
| parse regex "parent=(?P<parent_process>[^\s,]+)" nodrop
| eval deser_hit = if(matches(_raw, "(?i)(rO0AB|aced0005|ObjectInputStream)"), 1, 0)
| eval shell_spawn = if(matches(process_name, "(?i)(cmd\.exe|powershell|bash|sh|wget|curl|certutil)") and matches(parent_process, "(?i)(java|tomcat|jboss)"), 1, 0)
| where deser_hit = 1 OR shell_spawn = 1
| count by src_ip, uri_path, status_code, process_name, parent_process, deser_hit, shell_spawn
| sort by _count desc

rule cve_2026_12569_ptc_windchill_flexplm_exploit {
  meta:
    author = "df00tech detection engineering"
    description = "Detects exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM via deserialization payloads or post-exploitation shell spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-12569"

  events:
    (
      $http.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($http.target.url, `(?i)(/Windchill/|/FlexPLM/|/wt\.httpgw)`)
        or re.regex($http.target.url, `(?i)(rO0AB|aced0005|ObjectInputStream|java\.io\.)`)
      )
    )
    or (
      $proc.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($proc.principal.process.file.full_path, `(?i)(java|tomcat|jboss)`)
      and re.regex($proc.target.process.file.full_path, `(?i)(cmd\.exe|powershell|bash|/bin/sh|wget|curl|certutil)`)
    )

  condition:
    $http or $proc
}

#event_simpleName IN (NetworkConnectIP4, ProcessRollup2, SyntheticProcessRollup2)
| groupby([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, RemoteIP, RemotePort, event_simpleName])
| FileName IN ("cmd.exe", "powershell.exe", "bash", "sh", "wget", "curl", "certutil.exe")
  AND ParentBaseFileName MATCHES "(?i)(java|tomcat|jboss|windchill)"
| OR (
    event_simpleName = "NetworkConnectIP4"
    AND RemotePort IN (80, 443, 8080, 8443)
    AND (CommandLine MATCHES "(?i)(Windchill|FlexPLM|rO0AB|aced0005|ObjectInputStream)")
  )
| eval risk = case(
    FileName IN ("cmd.exe", "powershell.exe") AND ParentBaseFileName MATCHES "(?i)(java|tomcat)", "CRITICAL",
    CommandLine MATCHES "(?i)(rO0AB|aced0005)", "HIGH",
    true(), "MEDIUM"
  )
| table(ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, RemoteIP, RemotePort, risk)
| sort(risk, order=desc)